Traces Left by the Originator: Forensic Fingerprinting Hidden Malware in Images to Enable Attribution on the Example of SteganoAmor

Information Hiding used in malware is a recent trend.Its detection as well as origin attribution is of interest to hold actors responsible and provide well tuned prevention and reaction.We propose a Forensic Fingerprint for images to individualize traces left from malicious actors.The idea is to define feature spaces to structure artefacts in the stego objects caused by embedding code into a cover image as StegoFingerprint to describe Parameter-based-Artefacts and artefacts included in embedded malicious payloads as PayloadFingerprint to collect Payload-based-Artefacts.The approach is exemplary applied on 11 live samples (AV-Test cases) from the SteganoAmor campaign (appending code into JPEG meta data) and compared with a simulation using the known steganographic algorithm StegHide with an embedding into media data.We investigate how a first feature space of 10 StegoFingerprint and 32 PayloadFingerprint features can answer the questions: (1) Enable-Detection (EDE): How many incidents can be detected?, (2) Enable-Attribution (EAT): How many different attackers are active in detected cases? and (3) Enable-Discrimination of Identity (EDI): Can traces be used to attribute digital or real identities by using found trace knowledge in context searches.In summary results for the live samples and our simulations show that the Fingerprint can differentiate between attacks and derive for one live sample an attacker identity, pseudonymized in this paper.